Skip to content

Commit c1171ff

Browse files
adamchainzfelixxmnessitashaib
committed
[3.2.x] Fixed CVE-2024-24680 -- Mitigated potential DoS in intcomma template filter.
Thanks Seokchan Yoon for the report. Co-authored-by: Mariusz Felisiak <[email protected]> Co-authored-by: Natalia <[email protected]> Co-authored-by: Shai Berger <[email protected]>
1 parent 9dc3456 commit c1171ff

3 files changed

Lines changed: 140 additions & 19 deletions

File tree

‎django/contrib/humanize/templatetags/humanize.py‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -70,12 +70,13 @@ def intcomma(value, use_l10n=True):
7070
return intcomma(value, False)
7171
else:
7272
return number_format(value, use_l10n=True, force_grouping=True)
73-
orig = str(value)
74-
new = re.sub(r"^(-?\d+)(\d{3})", r'\g<1>,\g<2>', orig)
75-
if orig == new:
76-
return new
77-
else:
78-
return intcomma(new, use_l10n)
73+
result = str(value)
74+
match = re.match(r"-?\d+", result)
75+
if match:
76+
prefix = match[0]
77+
prefix_with_commas = re.sub(r"\d{3}", r"\g<0>,", prefix[::-1])[::-1]
78+
result = prefix_with_commas + result[len(prefix) :]
79+
return result
7980

8081

8182
# A tuple of standard large number to their converters

‎docs/releases/3.2.24.txt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,4 +6,8 @@ Django 3.2.24 release notes
66

77
Django 3.2.24 fixes a security issue with severity "moderate" in 3.2.23.
88

9-
...
9+
CVE-2024-24680: Potential denial-of-service in ``intcomma`` template filter
10+
===========================================================================
11+
12+
The ``intcomma`` template filter was subject to a potential denial-of-service
13+
attack when used with very long strings.

‎tests/humanize_tests/tests.py‎

Lines changed: 128 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -66,28 +66,144 @@ def test_i18n_html_ordinal(self):
6666

6767
def test_intcomma(self):
6868
test_list = (
69-
100, 1000, 10123, 10311, 1000000, 1234567.25, '100', '1000',
70-
'10123', '10311', '1000000', '1234567.1234567',
71-
Decimal('1234567.1234567'), None,
69+
100,
70+
-100,
71+
1000,
72+
-1000,
73+
10123,
74+
-10123,
75+
10311,
76+
-10311,
77+
1000000,
78+
-1000000,
79+
1234567.25,
80+
-1234567.25,
81+
"100",
82+
"-100",
83+
"1000",
84+
"-1000",
85+
"10123",
86+
"-10123",
87+
"10311",
88+
"-10311",
89+
"1000000",
90+
"-1000000",
91+
"1234567.1234567",
92+
"-1234567.1234567",
93+
Decimal("1234567.1234567"),
94+
Decimal("-1234567.1234567"),
95+
None,
96+
"１２３４５６７",
97+
"-１２３４５６７",
98+
"１２３４５６７.１２",
99+
"-１２３４５６７.１２",
100+
"the quick brown fox jumped over the lazy dog",
72101
)
73102
result_list = (
74-
'100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.25',
75-
'100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.1234567',
76-
'1,234,567.1234567', None,
103+
"100",
104+
"-100",
105+
"1,000",
106+
"-1,000",
107+
"10,123",
108+
"-10,123",
109+
"10,311",
110+
"-10,311",
111+
"1,000,000",
112+
"-1,000,000",
113+
"1,234,567.25",
114+
"-1,234,567.25",
115+
"100",
116+
"-100",
117+
"1,000",
118+
"-1,000",
119+
"10,123",
120+
"-10,123",
121+
"10,311",
122+
"-10,311",
123+
"1,000,000",
124+
"-1,000,000",
125+
"1,234,567.1234567",
126+
"-1,234,567.1234567",
127+
"1,234,567.1234567",
128+
"-1,234,567.1234567",
129+
None,
130+
"1,234,567",
131+
"-1,234,567",
132+
"１,２３４,５６７.１２",
133+
"-１,２３４,５６７.１２",
134+
"the quick brown fox jumped over the lazy dog",
77135
)
78136
with translation.override('en'):
79137
self.humanize_tester(test_list, result_list, 'intcomma')
80138

81139
def test_l10n_intcomma(self):
82140
test_list = (
83-
100, 1000, 10123, 10311, 1000000, 1234567.25, '100', '1000',
84-
'10123', '10311', '1000000', '1234567.1234567',
85-
Decimal('1234567.1234567'), None,
141+
100,
142+
-100,
143+
1000,
144+
-1000,
145+
10123,
146+
-10123,
147+
10311,
148+
-10311,
149+
1000000,
150+
-1000000,
151+
1234567.25,
152+
-1234567.25,
153+
"100",
154+
"-100",
155+
"1000",
156+
"-1000",
157+
"10123",
158+
"-10123",
159+
"10311",
160+
"-10311",
161+
"1000000",
162+
"-1000000",
163+
"1234567.1234567",
164+
"-1234567.1234567",
165+
Decimal("1234567.1234567"),
166+
-Decimal("1234567.1234567"),
167+
None,
168+
"１２３４５６７",
169+
"-１２３４５６７",
170+
"１２３４５６７.１２",
171+
"-１２３４５６７.１２",
172+
"the quick brown fox jumped over the lazy dog",
86173
)
87174
result_list = (
88-
'100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.25',
89-
'100', '1,000', '10,123', '10,311', '1,000,000', '1,234,567.1234567',
90-
'1,234,567.1234567', None,
175+
"100",
176+
"-100",
177+
"1,000",
178+
"-1,000",
179+
"10,123",
180+
"-10,123",
181+
"10,311",
182+
"-10,311",
183+
"1,000,000",
184+
"-1,000,000",
185+
"1,234,567.25",
186+
"-1,234,567.25",
187+
"100",
188+
"-100",
189+
"1,000",
190+
"-1,000",
191+
"10,123",
192+
"-10,123",
193+
"10,311",
194+
"-10,311",
195+
"1,000,000",
196+
"-1,000,000",
197+
"1,234,567.1234567",
198+
"-1,234,567.1234567",
199+
"1,234,567.1234567",
200+
"-1,234,567.1234567",
201+
None,
202+
"1,234,567",
203+
"-1,234,567",
204+
"１,２３４,５６７.１２",
205+
"-１,２３４,５６７.１２",
206+
"the quick brown fox jumped over the lazy dog",
91207
)
92208
with self.settings(USE_L10N=True, USE_THOUSAND_SEPARATOR=False):
93209
with translation.override('en'):

0 commit comments

Comments
 (0)